November 2024 - NANOG - lists.nanog.org

EA Game IP Geolocation
by Claire Dubois 11 Nov '24

11 Nov '24

Hi, We’ve recently received feedback from some of our customers reporting issues accessing EA games. It appears that IPs in our network are flagged or incorrectly identified in EA’s geo-location database, causing disruptions for our users. Does anyone have insight into which geo-location database Electronic Arts uses for their IP filtering or any steps to correct this issue? Thanks, *Claire Dubois* Huicast Telecom Limited www.huicast.com This e-mail and any attachments or any reproduction of this e-mail in whatever manner are confidential and for the use of the addressee(s) only. Huicast Telecom Limited can’t take any liability and guarantee of the text of the email message and virus.

2 1

Need AS3257/GTT Network Engineer Contact
by Aaron Atac 08 Nov '24

08 Nov '24

Hi, Seeking AS3257/GTT network engineering contact. We’ve been engaging your NOCC for the last 5 hours and haven’t made progress in issue resolution. Thanks, Aaron

1 0

Spoofer Report for NANOG for Oct 2024
by CAIDA Spoofer Project 08 Nov '24

08 Nov '24

In response to feedback from operational security communities, CAIDA's source address validation measurement project (https://spoofer.caida.org) is automatically generating monthly reports of ASes originating prefixes in BGP for systems from which we received packets with a spoofed source address. We are publishing these reports to network and security operations lists in order to ensure this information reaches operational contacts in these ASes. This report summarises tests conducted within usa, can. Inferred improvements during Oct 2024: ASN Name Fixed-By 19126 KIZAWIRELESS 2024-10-01 55 UPENN 2024-10-02 394195 CLEARNETWORX 2024-10-16 199203 2024-10-18 14031 SCXY 2024-10-30 54600 PEGTECHINC 2024-10-31 Further information for the inferred remediation is available at: https://spoofer.caida.org/remedy.php Source Address Validation issues inferred during Oct 2024: ASN Name First-Spoofed Last-Spoofed 3356 LEVEL3 2016-03-06 2024-10-11 40676 AS40676 2016-08-29 2024-10-28 27364 ACS-INTERNET 2016-09-27 2024-10-29 20412 CLARITY-TELECOM 2016-09-30 2024-10-31 12083 WOW-INTERNET 2016-11-09 2024-10-14 23314 ORLANDOTELCO 2017-04-14 2024-10-21 2152 CSUNET-NW 2017-11-08 2024-10-30 21804 ACCESS-SK 2019-06-09 2024-10-21 12183 TALKIE-COMMUNICATIONS 2022-12-10 2024-10-26 3701 NERONET 2023-04-18 2024-10-26 400282 2023-04-27 2024-10-30 393577 SCCNET 2023-05-03 2024-10-24 202400 2023-05-08 2024-10-21 61461 Airtek Solutions C.A. 2023-05-13 2024-10-31 20119 ARROW 2023-10-19 2024-10-31 394684 WISPERNET 2024-01-17 2024-10-26 394195 CLEARNETWORX 2024-03-22 2024-10-10 40850 ENKI 2024-04-03 2024-10-30 393530 TLU 2024-05-22 2024-10-30 19935 CRRS 2024-05-29 2024-10-29 3801 MISNET 2024-09-09 2024-10-29 30475 WEHOSTWEBSITES-COM 2024-09-30 2024-10-14 13807 GREAT-PLAINS-COMMUNICATIONS 2024-10-09 2024-10-09 20260 SAWTEL-UC 2024-10-16 2024-10-23 Further information for these tests where we received spoofed packets is available at: https://spoofer.caida.org/recent_tests.php?country_include=usa,can&no_block… Please send any feedback or suggestions to spoofer-info(a)caida.org

1 0

IPXO?
by Bryan Holloway 07 Nov '24

07 Nov '24

Anyone have any experiences -- good or bad -- with IPXO for IP address leasing? Either as a lessee or lessor? Feel free to respond off-list if you prefer.

3 2

Stream N92 Videos Now! Early Registration Ends Sunday
by Nanog News 07 Nov '24

07 Nov '24

*** N93 Early Registration Ends Sunday* ------------------------------------------------------------ *Don't Miss Your Opportunity for Discounted Registration Rates* Join us from Feb. 3-5, 2025 in Atlanta, GA for our next meeting, NANOG 93. Dive into the latest in networking tech and trends! *REGISTER NOW* <https://nanog.org/events/nanog-93/> *** Stream NANOG 92 Videos Now!* ------------------------------------------------------------ *Grab Some Popcorn + Watch Full N92 Playlist Now* *WATCH NOW <https://www.youtube.com/playlist?list=PLO8DR5ZGla8jZuNZqoXorIMACIUFeEfzd>* *** Check Out NANOG 92 Hackathon Recap* ------------------------------------------------------------ *Watch the Hackathon Wrap Up From our Last Meeting* *WATCH NOW <https://www.youtube.com/watch?v=4ijLfyqUjME&list=PLO8DR5ZGla8jZuNZqoXorIMAC…>* *** Stay Connected* ------------------------------------------------------------ http://www.facebook.com http://www.instagram.com/nanog_org/ http://www.linkedin.com/company/nanog/ https://www.twitter.com/nanog/ http://nanog.org

1 0

A plea to ignore abuse reports from "watchdogcyberdefense.com"
by Pierre Bourdon 07 Nov '24

07 Nov '24

Hi nanog, Some of you might have seen https://delroth.net/posts/spoofed-mass-scan-abuse/ circulating last week (it was also sent here in reply to someone who received abuse complaints from their ISP). The TL;DR is that some previously unknown company with a fancy looking domain name has started noticing the background noise on the internet and is sending automated abuse complaints to any owner of a source IP sending a SYN packet to port 22 on their network. They're not doing any filtering to try to prevent spoofed source addresses, and at this point there's plenty of evidence that they are seeing mostly spoofed src IPs, then sending abuse reports to a completely uninvolved owner of the IP. I've recently been in communication with that company. They sent me an email trying to get "advice" from me about how to not send abuse complaints to the whole internet, while ignoring the obvious answer of "don't mass send automated abuse complaints based on no evidence of abuse and no evidence of who sent you traffic". They're also making wild claims in their email to me, like, I quote, seeing "1.3 billion attacks logged in the past 24 hours". They're saying that they act on data sources like "we query the VirusTotal API for the source IP and it shows us it's infected with malware". If you're a NOC or someone handling abuse complaints for an ISP or a hosting provider, this is my plea to you: please send abuse reports from "watchdogcyberdefense.com" to your spam box until they understand 1. that a TCP SYN packet is spoofable; 2. that they're harming the internet through reducing trust in abuse complaints by sending so many false positives. I've myself had interactions with both Hetzner and Linode's abuse team, both of them have been top notch and understood what they're likely dealing with, but having to explain to every single ISP what's going on while sitting in the equivalent of an interrogation room threatened with a service suspension isn't a very comfortable situation. Thank you in advance, Best, -- Pierre Bourdon <delroth(a)gmail.com> Software Engineer @ Zürich, Switzerland https://delroth.net/

7 6

Upcoming changes to the DNSSEC root trust anchor
by Andres Pavez 05 Nov '24

05 Nov '24

Dear Colleagues, We are reaching out to inform you of important changes to the DNSSEC trust anchor in the root zone. If you manage a validating DNS resolver or a tool that interacts with the DNS root zone you might need to change your software to handle the changes. This letter provides a summary of the upcoming changes and gives pointers to resources that describe them in detail. *Upcoming addition of the KSK-2024 trust anchor* On January 11, 2025, a new trust anchor, codenamed KSK-2024, will appear in the root zone for the global DNS. This key was generated earlier this year and will co-exist with the current trust anchor, codenamed KSK-2017. The new DNSKEY record is: . 172800 IN DNSKEY 257 3 8 AwEAAa96jeuknZlaeSrvyAJj6ZHv28hhOKkx3rLGXVaC6rXTsDc449/c idltpkyGwCJNnOAlFNKF2jBosZBU5eeHspaQWOmOElZsjICMQMC3aeHb GiShvZsx4wMYSjH8e7Vrhbu6irwCzVBApESjbUdpWWmEnhathWu1jo+s iFUiRAAxm9qyJNg/wOZqqzL/dL/q8PkcRU5oUKEpUge71M3ej2/7CPqp dVwuMoTvoB+ZOT4YeGyxMvHmbrxlFzGOHOijtzN+u1TQNatX2XBuzZNQ 1K+s2CXkPIZo7s6JgZyvaBevYtxPvYLw4z9mR7K2vaF18UYH9Z9GNUUe ayffKC73PYc= As a result of this addition, some DNS responses may be larger during the transition period. If your software uses the RFC 5011 process for managing trust anchors, KSK-2024 will be automatically trusted about one month after its introduction to the root zone. There are two important planned dates: * October 11, 2026: KSK-2024 will begin signing the root zone. * January 11, 2027: KSK-2017 is scheduled to be revoked. For a detailed description of the rollover process, please refer to https://www.iana.org/dnssec/files *New trust anchor file* IANA has issued a new trust anchor file using the updated XML format described in https://datatracker.ietf.org/doc/draft-ietf-dnsop-rfc7958bis/ , which has recently been approved to be published as an RFC. The new trust anchor file contains additional data that was not provided in previous versions of the file. If your software or processes use the IANA trust anchor file (published at https://data.iana.org/root-anchors/root-anchors.xml ), you should ensure you have processes to retrieve it regularly (such as weekly) and check your systems can process the revised format of the file. *Keep in touch* Operational announcements regarding trust anchors and rollovers are published on the root-dnssec-announce mailing list at https://lists.icann.org/postorius/lists/root-dnssec-announce.icann.org/ . A separate ksk-rollover mailing list is a forum for discussion specific to rollovers can be found at https://lists.icann.org/postorius/lists/ksk-rollover.icann.org/ . Best regards, -- Andres Pavez Cryptographic Key Manager

1 0

J Root woes on v4
by Eric Dugas 04 Nov '24

04 Nov '24

Hello, It seems that J Root has suboptimal routing over v4 but v6 is OK from my POV in Montreal, Canada. Route changes occurred ~5h ago. v4: ~260ms somewhere in Asia via our HE bilateral in Montreal, Canada (AS-PATH 6939 45629 55423 55423 26415 396651 396651) 55423 might host a legit J Root node, but it should be exported outside their region by AS45629 or HE. v6: ~24ms in Chicago via Arelion IPT in Montreal, Canada (AS-PATH 1299 7342 36631 36631) This one looks legit. Eric

1 0

Microsoft NOC Contact - ASN Association Request
by Christopher Hawker 04 Nov '24

04 Nov '24

Hello all, If anyone from AS8075 is lurking around, could you please reach out to me off-list? Backstory: We submitted an ASN Association (not peering) request to associate our AS with an Azure tenancy, and they rejected the request on the grounds that they "currently don't see any traffic for ASN". Regards, Christopher Hawker

2 2

IANA IPv6 Global Unicast Address Assignments Registry Update
by David Dong 01 Nov '24

01 Nov '24

Hi, The IANA IPv6 Global Unicast Address Assignments registry has been updated to reflect the allocation of the following block to APNIC: 2410::/12 APNIC 2024-11-01 You can find the registry at: https://www.iana.org/assignments/ipv6-unicast-address-assignments/ The allocation was made in accordance with the Policy for Allocation of IPv6 Blocks to Regional Internet Registries: https://www.icann.org/resources/pages/allocation-ipv6-rirs-2012-02-25-en Best Regards, David Dong IANA Services Sr. Specialist

1 0